Origin Validation Error Affecting glances package, versions <4.5.2+dfsg-1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIANUNSTABLE-GLANCES-15704339
- published20 Mar 2026
- disclosed18 Mar 2026
Introduced: 18 Mar 2026
CVE-2026-32634 (opens in a new tab)How to fix?
Upgrade Debian:unstable glances to version 4.5.2+dfsg-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream glances package and not the glances package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global [passwords] default credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2 fixes the issue.